Should Shopify merchants grant theme-write access to an app just to publish AI-readable files?
You install an app to help AI tools understand your store. During setup, it asks for permission to write to your theme.
That permission deserves a pause.
A theme is not just a design file. It controls what shoppers see, how pages load, and sometimes how other apps work. An app may have a good reason to change it. But publishing an AI-readable file is not, by itself, a good reason to grant broad theme access.
For most Shopify stores, the answer is no.
Shopify already publishes the files
Shopify now serves AI-discovery files automatically for every store. That includes:
- `/agents.md`
- `/llms.txt`
- `/llms-full.txt`
Shopify says you do not need a third-party app to generate these files.
You can check this in under a minute. Replace `yourstore.com` with your domain, then open:
`https://yourstore.com/agents.md`
Also try:
`https://yourstore.com/llms.txt`
Shopify treats `/agents.md` as the canonical version. The other two URLs are compatibility URLs and mirror it by default.
This matters because an app cannot add value merely by putting a file at a URL Shopify already manages. Before approving a permission, check whether Shopify already does the job.
What Shopify puts in the managed file
Shopify's managed `/agents.md` includes store-discovery details such as:
- Your store URL
- Your sitemap
- Published policy pages
- A UCP discovery URL
- An MCP endpoint
Its documented endpoints include `/.well-known/ucp` and `/api/ucp/mcp`.
That is useful groundwork for an AI system trying to find its way around a storefront. But it does not replace good product information, clear policies, or a store that works properly on a phone.
A file can point to your catalogue. It cannot fix a vague product title or an incomplete returns page.
Theme-write access is a larger permission than it sounds
An app that can write to your theme can create or overwrite theme files. Shopify's `themeFilesUpsert` mutation can process up to 50 files in one request.
That does not mean every app using this access is unsafe. It means the permission has real reach.
Shopify says most apps that integrate with themes should use theme app extensions. It also says a public app that modifies a theme or theme files needs the `write_themes` scope and a Shopify exemption.
There is another practical point: a write scope includes read access. So an app requesting `write_themes` is not asking only to place one small text file. It is asking for access to inspect and alter theme files.
Shopify's App Store rules say apps should request only the scopes needed for their function. That is a useful rule for merchants too.
Ask a plain question: could this app do its stated job without writing to my theme?
If the job is only to publish `/agents.md`, `/llms.txt`, or `/llms-full.txt`, the answer is usually yes. Shopify already serves them.
When a custom file could make sense
There is a difference between accepting Shopify's managed file and wanting to customize one.
Shopify lets merchants customize these files in the theme code. You can add one of these templates:
- `templates/agents.md.liquid`
- `templates/llms.txt.liquid`
- `templates/llms-full.txt.liquid`
If you add a custom template, make sure every line is suitable for public display. Shopify describes the document as a public storefront page, not a private app file.
Do not add private contact details, internal notes, supplier information, or anything you would not want indexed and shared.
A safe reason to customize might be adding a short public explanation of a special ordering rule that is already visible elsewhere on your site. Even then, first ask whether the same information belongs on the relevant product, collection, shipping, or policy page instead.
Your ordinary storefront pages are still where shoppers and AI tools should find the details that affect a purchase.
We chose not to request theme-write access
When we built Descriva, we shipped it without theme-write permission on purpose.
The trade is simple. If a merchant needs a custom `llms.txt`, we provide a template for them to paste into their theme. Then Descriva reads the live URL afterwards. It does not assume the paste worked.
That route creates one extra merchant step. It also means the app has fewer permissions and asks for less trust.
We learned this matters in other work too. Our free scanner reads public URLs only: `robots.txt`, the catalogue endpoint, product markup, and policy pages. There is no install and no login required to learn the basics.
That approach has limits. Public checks cannot see everything behind the Shopify admin. But a limit is often better than a permission the task does not need.
A practical way to decide
If an app asks for theme-write access to publish an AI-readable file, work through these checks before approving it.
1. Open Shopify's version first. Visit `/agents.md` on your live domain. If it loads, you already have a managed file.
2. Ask what the app would change. Request the exact filename, the file contents, and whether it would overwrite an existing template.
3. Ask why Shopify's managed file is not enough. A useful answer should name a specific need, not just say the store will be more AI-ready.
4. Check whether the change can be manual. For a small template, copying code into the theme may be more appropriate than granting a standing write permission.
5. Read the finished URL. After any change, open the public file in a private browser window. Check for private details, broken links, or text that does not match your store.
6. Review permissions as the app changes. An app may need more access later for a separate feature. That is the time to judge that feature, not a reason to grant access early.
The better default
Use Shopify's managed AI-discovery files unless you have a clear, public, store-specific reason to customize them.
If you do customize them, keep the change small. Put purchase-critical facts on the pages shoppers already use. And do not grant theme-write access simply because an app says it can publish a file for you.
Your next step is simple: open `yourstore.com/agents.md` and see what Shopify already serves.